Hi Colin, On Fri, Oct 09, 2026 at 01:43:30PM +0100, Colin Watson wrote: > On Tue, Oct 06, 2026 at 12:20:05AM -0300, Carlos Henrique Lima Melara wrote: > > On Thu, Sep 17, 2026 at 08:32:14PM +0200, Salvatore Bonaccorso wrote: > > > The following vulnerabilities were published for parted. > > > > > > CVE-2026-89085[0]: > > > | heap buffer overflow in _init_fats / fat_table_read > > > > > > > > > CVE-2026-89088[1]: > > > | heap buffer overflow in duplicate_legacy_root_dir > > > > > > > > > If you fix the vulnerabilities please also make sure to include the > > > CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. > > > > I'm working on these two CVEs for LTS and would like to help fixing them > > on trixie too if it's okay for you. Code did not change a lot between > > 3.6 and 3.7.13 so no backport was needed. There is a test included but I > > failed to make it run properly with or without the patch. As a better > > regression test tool, I've uploaded to debusine [1] and pushed the > > proposed changes to my fork [2], if it's fine for you, I'd love to have > > trixie's [2] and bookworm's [3] version in the official git repo (and > > hopefully I did everything right with git-dpm :-) > > Your branches look OK to me. Thanks for working on this!
Ack, will finish testing and fill a trixie-pu bug. > Would you be OK with me just adding you to parted-team? I'd be happy to do > that, and then you can merge things yourself. Yeah, that's fine by me! Cheers, Charles
